Hi,

Whilst working on the Reproducible Builds effort [0], we noticed that
fontforge generates .afm and .pfb files that are unreproducible.

Specifically, whilst they use SOURCE_DATE_EPOCH for the timestamps,
they still vary on the timezone due to the use of ctime(3).

Patch attached, which at least causes packages such as t1-teams to be
reproducible.

However, there are many other ctime callsites in the codebase that might
require upstream to investigate: some of them are for ~diagnostic output
for human consumption, so likely should specify the timezone explicitly,
whatever it is.

(Alternatively, another method could be added to gutils/gutils.c alongside
GetTime that will return asctime(gmtime(arg)) if SOURCE_DATE_EPOCH is present,
otherwise return cmtime(arg), and then callsites could use this one.)

  [0] https://reproducible-builds.org/


Regards,

Hello,

Bug #1142495 in fontforge reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/fonts-team/fontforge/-/commit/605e520de516614862254b49de43d6d387f64dec

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142495

We believe that the bug you reported is fixed in the latest version of
fontforge, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142495@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastian Germann <bage@debian.org> (supplier of updated fontforge package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 28 Jul 2026 18:47:51 +0200
Source: fontforge
Architecture: source
Version: 1:20230101~dfsg-9
Distribution: unstable
Urgency: medium
Maintainer: Debian Fonts Task Force <debian-fonts@lists.debian.org>
Changed-By: Bastian Germann <bage@debian.org>
Closes: 1142495
Changes:
 fontforge (1:20230101~dfsg-9) unstable; urgency=medium
 .
   * Team upload
   * Make afm and pfb timezone-independent (Closes: #1142495)
   * lintian: Drop alien tag
Checksums-Sha1:
 ce95f78c2c109262208e9a1e27e075b1ca365666 2806 fontforge_20230101~dfsg-9.dsc
 b713626c5837ee6c3a55bf8f0724f6ed387903bd 125844 fontforge_20230101~dfsg-9.debian.tar.xz
 9f21c5dcb674e244abf318f66f7a92718c28ed5f 15602 fontforge_20230101~dfsg-9_source.buildinfo
Checksums-Sha256:
 2f6e31b116a3d65c5600c82caebbde14084f134616f668e104b976405fb30099 2806 fontforge_20230101~dfsg-9.dsc
 c5980f81f13d195dd9187df1900449501b2c7cec07d71bbc6537d87ff1dbad3c 125844 fontforge_20230101~dfsg-9.debian.tar.xz
 67249f23eb00fba7042a10ecce591855849c86e16dd7ce346c8791fe93ac8477 15602 fontforge_20230101~dfsg-9_source.buildinfo
Files:
 f22f784edaca0cb7ef4f3292225ec1ed 2806 fonts optional fontforge_20230101~dfsg-9.dsc
 3762c641c84dc6a223c987282c185917 125844 fonts optional fontforge_20230101~dfsg-9.debian.tar.xz
 02f7302277487f92dd93d183cd7a0e48 15602 fonts optional fontforge_20230101~dfsg-9_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmpo3bQQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFHsUDACXQ36C8rWbOHvbuZ81uO243af2or0GMYRr
rnJCtcmeDFHuJmxv0pOp8PkYBYETcGGYnyaeWuCZlrV+383gk4ZLT8kAx3yPc90o
g3COe72DT6t4E1B68UvpuyHMzkjwCxPdoWE7aQihpUrdD6KSPPt4RMjR+sGQR8FP
P12udfPB2Es4+zDIUrZzadZUxPUMOqr0QuEP1uSy16//8nwsdzZz8YFQ5DYCJUEF
8OSVnPTbertbUUKIuGREHz+OhHyzWHuOcl7N2e4q7dCQchKDz1Gc5K6jumHJSEc7
B1doPWFdoB73ZRk57whXy+m7FFImqAcjJpu7l7cFRfN7xL452K9F75WRMtxJ9M6O
+2dmMvoKz1WYChwAnC/375wmt+Bw0IfkiS1yP2r4rzEn1YEiC7T/ZCXzOvmgLoSE
L0zZE+hhcPTKQ17Gfm9GC+jr/lj7s9vd9k89TQ8zSuyQ65lY8Y+sLTdqYOcFVpPu
S3ejsRvSZEKjxmtzBBJ1EK2/X74w1k4=
=7QhU
-----END PGP SIGNATURE-----